Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
0answers
17 views

how to find a cryptography scheme (either authentication or encryption) for which some formal analysis of security has not been done yet

I have a project in Cryptography where I have to discuss the provable security of any proposed scheme (encryption or authentication) which has not been discussed yet. Any pointers on how and where to ...
21
votes
4answers
3k views

How would you store a 4 digit pin code securely in the database?

I'm familiar with password hashing, using salts, bcrypt etc. But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
0
votes
3answers
147 views

How strong is a simple XOR encryption with random IV?

I'd like to implement some kind of simple (yet as strong as possible) encryption for my client-server application network traffic. Data to be encrypted can be both textual, and binary. Now I'm ...
1
vote
1answer
50 views

How to store derby database encryption key in HSM?

The Derby Database supports encryption with a key or password. Traditionally this key is stored in the file systems, now I am looking to store and protect this key in the HSM instead, but I couldn't ...
3
votes
2answers
227 views

Continued Use of Kerberos

I posted this question over on Crypto.SE, but didn't get any takers and thought it might be more suited for this site as it were, so I'm cross posting it here. I was recently looking through the Mac ...
0
votes
1answer
88 views

PHP secure random number generator [on hold]

I just wrote this function and I was curious if anyone could find any flaws in it? It look pretty secure to me but I just want to make sure since I'm no cryptography expert. function ...
9
votes
3answers
2k views

Suitable cipher for SMS encryption

I would like to create application for encrypting SMS messages. After long enough discussions I decided to use symmetric encryption, since handling public/private keys issue is too difficult for most ...
0
votes
1answer
57 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
-1
votes
1answer
34 views

Calculating the breakability of a given encryption method

I will soon be doing a very important project for school. The main goal of my project is to find a mathematical way to calculate the breakability of a given encryption method of ciphertext. Is there ...
4
votes
4answers
372 views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
1
vote
1answer
71 views

NaCL: Encrypt file to multiple recipients

I am trying to understand the Networking And Cryptography Library (NaCL). Consider i have a file that i want to send to multiple recipients. PGP or S/MIME supports multiple recipients by encrypting ...
1
vote
2answers
141 views

What is DVNC and how does it work?

As stated on their website: DVNC is not encryption but is a new branch of cryptography and information science. DVNC employs a new paradigm in secret keeping to keep your data secured. I ...
0
votes
2answers
129 views

How safe is it to use older/unknown Encryption methods for plaintext?

When mailing or chatting with people, it had crossed my mind, what if, for simple communication, someone would use an older encryption method (i.e., ENIGMA), to encrypt their message? Would because ...
0
votes
1answer
46 views

Why do we encrypt ephemeral Public key in Encrypted Key Exchange

Encrypted Key Exchange can resist off-line dictionary attack Protocol : A ---> B : Ep (PK) B ---> A : Ep(Epk(K)) K is Session Key generated by B PK is an ephemeral public key ...
2
votes
4answers
373 views

How to prove to friend I have solution to puzzle (without revealing it)? [closed]

My friend Paul set me this arithmetic puzzle: To make 21 from the numbers 1, 5, 6, 7. You can use the operations add, subtract, multiply, divide as well as brackets. You must use each number once. ...
1
vote
1answer
79 views

How are SHA1 and MD5 considered to not protect against collisions?

SHA1 and MD5 hash functions are considered to not protect against collisions while SHA2 is. Is it the size of the message digest that makes this or the algorithm itself? If it is based on the message ...
11
votes
3answers
9k views

License key / Serial number generator and checker

I need a serial number generator and accompanying checker. I would like to be able to set a salt (and maybe a length). The generator should only produce serial numbers that pass the test of the ...
1
vote
1answer
48 views

How can you check if a private key and certificate match in OpenSSL with ECDSA?

I know how to do this with RSA keys (see this article: Determine if private key belongs to certificate?) however I do not know how to do this for ECDSA certificate / key pairs. With RSA keys, the ...
0
votes
0answers
22 views

Rabin Cryptosystem Problem (variant) [migrated]

My understanding of Rabin We have p and q which are distinct primes congruent to 3 mod 4. Then we have n = p*q. Encryption is done as e(m) = m^2 mod n, where m is our message. Decryption is done ...
16
votes
2answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
1
vote
1answer
238 views

Requiring 2 keys to access a content

I need to use an external service that can only be accessed by password. I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do. Considering this ...
126
votes
8answers
12k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
0
votes
1answer
60 views

Does encrypting the message protect it against length extension attacks

Assuming the following HMAC is used : HMACK(M) = Hash(K||M) = H which is "secret-prefix" hashed function. M is the plaintext message , K is the secret key used The ciphertext is generated as follow : ...
0
votes
1answer
84 views

AES 128bit decryption using a key longer than 16 bytes

I got a little problem regarding AES decryption. I have to decrypt some text that has been encrypted using 128bit AES / ECB with PHP mcrypt. The thing is, the key that is being used to encrypt/decrypt ...
2
votes
0answers
65 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
1
vote
1answer
174 views

How to safely use a Key Derivation Function to secure private data - need guidance

I have some secure data created in my client app which I wish to store on the server as backup for the user. The user already has a password to authenticate with the server. The password is never ...
2
votes
1answer
216 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
3
votes
0answers
58 views

Zero Knowledge Example using discrete log [migrated]

I've been exploring Zero Knowledge Proofs and while the classic cave example by Jean-Jacques Quisquater makes sense, I find the discrete log example problematic. Since the Verifier is given p, g and ...
26
votes
3answers
19k views

What is ECDHE-RSA?

What is the difference between ECDHE-RSA and DHE-RSA? I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
0
votes
1answer
78 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
-1
votes
0answers
23 views

running ECDH with CommonCrypto for iOS [migrated]

I am looking for the methods in CommonCrypto to generate the shared secret based on ECDH. I can find proprietary implementations but nothing standard. This method is called sometimes Key Exchange and ...
1
vote
1answer
308 views

Minimal HTTPS SSL client in C [closed]

I want to implement an HTTPS client using pure C. I have implemented an HTTP client, and it works just fine. My question is: I know the HTTPS protocol does some kind of negotiation to announce what ...
5
votes
0answers
167 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
1
vote
2answers
94 views

POODLE and REST APIs

Are non-browser applications which do not contain an embedded browser, and merely make REST API calls over HTTPS, vulnerable to POODLE? And if not, is it unnecessary to disable SSL in such ...
1
vote
1answer
57 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when attacker cant get our hashing schema, brute force or dictionary attack would be much less efficient. Am i right or is it ...
0
votes
2answers
35 views

encryption using two keys

The use case is analogous to accessing a safe box in a bank. There is a per-user key, unique for each user, either generated by the system or hashed from the user's password. And there is a ...
55
votes
8answers
119k views

How to determine what type of encoding/encryption has been used?

I've looked on this site and on SE. but i couldn't get a handle on this. Is there a way to find what type of encryption/encoding is being used? For example, I am testing a web application which ...
0
votes
1answer
103 views

Why is not safe to use the same public key in RSA?

In the RSA context, why is not safe to use the same n (public key)for different people?
1
vote
2answers
48 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
2
votes
2answers
83 views

Encrypted container on top of a copy-on-write filesystem

The way I understand it, when you write to a copy-on-write filesystem, data never gets overwritten in place, instead new data is written to a new location, and the old data will only be overwritten ...
3
votes
1answer
76 views

Encryption and HMAC with the same password

I need to send authenticated ciphered messages by using a single password. Reusing the same (derived) key for the block cipher and the HMAC is not a good practice, I know. My initial idea is to ...
4
votes
2answers
4k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
0
votes
1answer
95 views

Is (WEP) shared key authentication secure?

I've been reading up on wireless authentication and shared key authentication sounds completely bonkers. I know WEP is very insecure and breaking it with aircrack-ng takes 5-15 minutes but this sounds ...
76
votes
3answers
11k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice? Or should ...
0
votes
0answers
19 views

Infer encoding mechanism from n-grams distance

I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance (implying some encoding mechanism as opposed to an encryption procedure ...
4
votes
2answers
3k views

Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data? If the latter, then if someone had access ...
18
votes
5answers
24k views

Asymmetric vs Symmetric Encryption

I am currently taking a principles of information security class. While talking about different encryption methods a large number of my classmates seem to believe that Asymmetric Encryption is better ...
18
votes
3answers
1k views

What is the difference between “key length” and “bit strength”?

On occasion, I hear the terms "key length" and "bit strength" used interchangeably. Are these the same things? Or are they different?
108
votes
3answers
79k views

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
-1
votes
1answer
43 views

Permutation based file secure

I have a thought. 1. Take a file. 2. Read number of bytes. If its less than 2048, padd it till 2048 3. Read each byte. And create a single file which contains the particular byte. Give a random name ...